% This file was created with JabRef 2.9.2.
% Encoding: Cp1252

@INPROCEEDINGS{KatebMTHX12,
  author = {Donia El Kateb and Tejeddine Mouelhi and Yves Le Traon and JeeHyun
	Hwang and Tao Xie},
  title = {Refactoring access control policies for performance improvement},
  booktitle = {ICPE},
  year = {2012},
  pages = {323-334},
  bibsource = {DBLP, http://dblp.uni-trier.de},
  crossref = {DBLP:conf/wosp/2012},
  ee = {http://doi.acm.org/10.1145/2188286.2188346}
}

@ARTICLE{Abed2011a,
  author = {Abed, Wisam Al and Kienzle, J\"{o}rg},
  title = {{Aspect-oriented modelling for distributed systems}},
  journal = {Model Driven Engineering Languages and Systems},
  year = {2011},
  pages = {123--137},
  file = {:Users/yehia/Dropbox/Work/Bibliography/Articles/Abed, Kienzle - 2011 - Aspect-oriented modelling for distributed systems.pdf:pdf},
  url = {http://www.springerlink.com/index/Q1404747Q7W0KLX3.pdf}
}

@ARTICLE{Alam2006,
  author = {Alam, Muhammad},
  title = {{Model Driven Security Engineering for the Realization of Dynamic
	Security Requirements in Collaborative Systems}},
  journal = {MoDELS'06 Proceedings of the 2006 international conference on Models
	in software engineering},
  year = {2006},
  pages = {278--287},
  file = {:Users/yehia/Dropbox/Work/Bibliography/Articles/Alam - 2006 - Model Driven Security Engineering for the Realization of Dynamic Security Requirements in Collaborative Systems.pdf:pdf}
}

@ARTICLE{Almorsy2012,
  author = {Almorsy, Mohamed and Grundy, John and Ibrahim, AS},
  title = {{MDSE@ R: Model-Driven Security Engineering at Runtime}},
  journal = {CSS},
  year = {2012},
  pages = {279--295},
  file = {:Users/yehia/Dropbox/Work/Bibliography/Articles//Almorsy, Grundy, Ibrahim - 2012 - MDSE@ R Model-Driven Security Engineering at Runtime.pdf:pdf},
  keywords = {aspect-oriented programming,domain-specific visual languages,model-driven
	engineering,security engineering},
  url = {http://dblp.uni-trier.de/rec/bibtex/conf/css/AlmorsyGI12}
}

@INPROCEEDINGS{autrel2008motorbac,
  author = {Autrel, Fabien and Cuppens, Fr{\'e}d{\'e}ric and Cuppens-Boulahia,
	N and Coma, C{\'e}line},
  title = {MotOrBAC 2: a security policy tool},
  booktitle = {3rd Conference on Security in Network Architectures and Information
	Systems (SAR-SSI 2008), Loctudy, France},
  year = {2008},
  pages = {273--288}
}

@INPROCEEDINGS{Balaban2011a,
  author = {Balaban, Mira and Kifer, Michael},
  title = {{Logic-based model-level software development with F-OML}},
  booktitle = {Model Driven Engineering Languages and Systems},
  year = {2011},
  series = {MODELS'11},
  pages = {517--532},
  address = {Berlin, Heidelberg},
  publisher = {Springer-Verlag},
  abstract = {Models are at the heart of the emerging Model-driven Engineering (MDE)
	approach in which software is developed by repeated transformations
	of models. Intensive efforts in the modeling community in the past
	two decades have produced an impressive variety of tool support for
	models. Nonetheless, models are still not widely used throughout
	the software evolution life cycle and, in many cases, they are neglected
	in later stages of software development. To make models more useful,
	one needs a powerful model-level IDE that supports a wide range of
	object modeling tasks. Such IDEs must have a consistent formal foundation.
	This paper introduces F-OML, a language intended as an expressive,
	executable formal basis for model-level IDEs. F-OML supports a wide
	variety of model-level activities, such as extending UML diagrams,
	defining design patterns, reasoning about UML diagrams, testing UML
	diagrams, specification of Domain Specific Modeling Languages, and
	meta-modeling. F-OML is a semantic layer on top of an elegant logic
	programming language of guarded path expressions, called PathLP.
	We believe that a combination of current object technology with F-OML
	as an underlying language can lay the basis for a powerful model-level
	IDE.},
  file = {:Users/yehia/Dropbox/Work/Bibliography/Articles/Balaban, Kifer - 2011 - Logic-based model-level software development with F-OML.pdf:pdf},
  isbn = {978-3-642-24484-1},
  url = {http://dl.acm.org/citation.cfm?id=2050655.2050708 http://www.springerlink.com/index/W168338810K45N3H.pdf}
}

@ARTICLE{Barth2006,
  author = {Barth, a. and Datta, a. and Mitchell, J.C. and Nissenbaum, H.},
  title = {{Privacy and contextual integrity: framework and applications}},
  journal = {2006 IEEE Symposium on Security and Privacy (S\&P'06)},
  year = {2006},
  pages = {15 pp.--198},
  doi = {10.1109/SP.2006.32},
  file = {:Users/yehia/Dropbox/Work/Bibliography/Articles/Barth et al. - 2006 - Privacy and contextual integrity framework and applications.pdf:pdf},
  isbn = {0-7695-2574-1},
  publisher = {Ieee},
  url = {http://ieeexplore.ieee.org/lpdocs/epic03/wrapper.htm?arnumber=1624011}
}

@ARTICLE{Barth2007,
  author = {Barth, Adam and Mitchell, John and Datta, Anupam and Sundaram, Sharada},
  title = {{Privacy and Utility in Business Processes}},
  journal = {20th IEEE Computer Security Foundations Symposium (CSF'07)},
  year = {2007},
  pages = {279--294},
  number = {May},
  month = jul,
  doi = {10.1109/CSF.2007.26},
  file = {:Users/yehia/Dropbox/Work/Bibliography/Articles/Barth et al. - 2007 - Privacy and Utility in Business Processes.pdf:pdf},
  isbn = {0-7695-2819-8},
  issn = {1063-6900},
  publisher = {Ieee},
  url = {http://ieeexplore.ieee.org/lpdocs/epic03/wrapper.htm?arnumber=4271655}
}

@ARTICLE{Basin2009,
  author = {Basin, David and Clavel, Manuel and Doser, J\"{u}rgen and Egea, Marina},
  title = {{Automated analysis of security-design models}},
  journal = {Information and Software Technology},
  year = {2009},
  volume = {51},
  pages = {815--831},
  number = {5},
  month = may,
  doi = {10.1016/j.infsof.2008.05.011},
  file = {:Users/yehia/Dropbox/Work/Bibliography/Articles/Basin et al. - 2009 - Automated analysis of security-design models.pdf:pdf},
  issn = {09505849},
  keywords = {access control policies,formal analysis,metamodels,ocl,secureuml,security
	policies,uml},
  url = {http://linkinghub.elsevier.com/retrieve/pii/S095058490800075X}
}

@INPROCEEDINGS{Basin2011,
  author = {Basin, David and Clavel, Manuel and Egea, M.},
  title = {{A decade of model-driven security}},
  booktitle = {Proceedings of the 16th ACM symposium on Access control models and
	technologies},
  year = {2011},
  pages = {1--10},
  publisher = {ACM},
  file = {:Users/yehia/Dropbox/Work/Bibliography/Articles/Basin, Clavel, Egea - 2011 - A decade of model-driven security.pdf:pdf},
  isbn = {9781450306881},
  keywords = {code generation,model anal-,model transformation,model-driven development,model-driven
	security,ysis},
  url = {http://portal.acm.org/citation.cfm?id=1998443}
}

@ARTICLE{Basin2007a,
  author = {Basin, David and Clavel, Manuel and Egea, Marina},
  title = {{A Metamodel-Based Approach for Analyzing Security-Design Models}},
  journal = {MODELS},
  year = {2007},
  pages = {420--435},
  file = {:Users/yehia/Dropbox/Work/Bibliography/Articles//Basin et al. - 2007 - A Metamodel-Based Approach for Analyzing Security-Design Models.pdf:pdf}
}

@ARTICLE{Basin2006a,
  author = {Basin, David and Doser, J. and Lodderstedt, T.},
  title = {{Model driven security: From UML models to access control infrastructures}},
  journal = {ACM Transactions on Software Engineering and Methodology (TOSEM)},
  year = {2006},
  volume = {15},
  pages = {39--91},
  number = {1},
  file = {:Users/yehia/Dropbox/Work/Bibliography/Articles/Basin, Doser, Lodderstedt - 2006 - Model driven security From UML models to access control infrastructures.pdf:pdf;:Users/yehia/Dropbox/Work/Bibliography/Articles/Basin, Doser, Lodderstedt - 2006 - Model driven security From UML models to access control infrastructures.pdf:pdf},
  institution = {ETH Swiss Federal Institute of Technology Zurich},
  publisher = {ACM},
  url = {http://portal.acm.org/citation.cfm?id=1125810}
}

@INPROCEEDINGS{Basin2003b,
  author = {Basin, David and Doser, J\"{u}rgen and Lodderstedt, Torsten},
  title = {{Model driven security for process-oriented systems}},
  booktitle = {Proceedings of the eighth ACM symposium on Access control models
	and technologies - SACMAT '03},
  year = {2003},
  pages = {100},
  address = {New York, New York, USA},
  publisher = {ACM Press},
  doi = {10.1145/775412.775425},
  file = {:Users/yehia/Dropbox/Work/Bibliography/Articles/Basin, Doser, Lodderstedt - 2003 - Model driven security for process-oriented systems(2).pdf:pdf},
  isbn = {1581136811},
  url = {http://dl.acm.org/citation.cfm?id=775425 http://portal.acm.org/citation.cfm?doid=775412.775425}
}

@ARTICLE{Ben-Ghorbel-Talbi2010,
  author = {Ben-Ghorbel-Talbi, Meriam and Cuppens, Fr\'{e}d\'{e}ric and Cuppens-Boulahia,
	Nora and Bouhoula, Adel},
  title = {{A delegation model for extended RBAC}},
  journal = {International Journal of Information Security},
  year = {2010},
  volume = {9},
  pages = {209--236},
  number = {3},
  month = may,
  doi = {10.1007/s10207-010-0104-3},
  file = {:Users/yehia/Dropbox/Work/Bibliography/Articles/Ben-Ghorbel-Talbi et al. - 2010 - A delegation model for extended RBAC.pdf:pdf},
  issn = {1615-5262},
  keywords = {administration,delegation,orbac model,revocation,role-based access
	control},
  owner = {Moussa.Amrani},
  timestamp = {2013.03.12},
  url = {http://www.springerlink.com/index/10.1007/s10207-010-0104-3}
}

@ARTICLE{Breu2007a,
  author = {Breu, Ruth and Popp, Gerhard and Alam, Muhammad},
  title = {{Model based development of access policies}},
  journal = {International Journal on Software Tools for Technology Transfer},
  year = {2007},
  volume = {9},
  pages = {457--470},
  number = {5-6},
  month = jul,
  doi = {10.1007/s10009-007-0045-y},
  file = {:Users/yehia/Dropbox/Work/Bibliography/Articles/Breu, Popp, Alam - 2007 - Model based development of access policies(2).pdf:pdf},
  issn = {1433-2779},
  url = {http://www.springerlink.com/index/10.1007/s10009-007-0045-y}
}

@ARTICLE{Busch2012,
  author = {Busch, Marianne and Koch, Nora and Masi, Massimiliano and Pugliese,
	Rosario and Tiezzi, Francesco},
  title = {{Towards model-driven development of access control policies for
	web applications}},
  journal = {Proceedings of the Workshop on Model-Driven Security - MDsec '12},
  year = {2012},
  pages = {1--6},
  address = {New York, New York, USA},
  doi = {10.1145/2422498.2422502},
  file = {:Users/yehia/Dropbox/Work/Bibliography/Articles//Busch et al. - 2012 - Towards model-driven development of access control policies for web applications.pdf:pdf},
  isbn = {9781450318068},
  keywords = {model-driven development,security,web engineering},
  publisher = {ACM Press},
  url = {http://dl.acm.org/citation.cfm?doid=2422498.2422502}
}

@ARTICLE{Cuppens2007c,
  author = {Cuppens, Fr\'{e}d\'{e}ric and Cuppens-Boulahia, Nora and Ghorbel,
	Meriam Ben},
  title = {{High Level Conflict Management Strategies in Advanced Access Control
	Models}},
  journal = {Electronic Notes in Theoretical Computer Science},
  year = {2007},
  volume = {186},
  pages = {3--26},
  month = jul,
  doi = {10.1016/j.entcs.2007.01.064},
  file = {:Users/yehia/Dropbox/Work/Bibliography/Articles/Cuppens, Cuppens-Boulahia, Ghorbel - 2007 - High Level Conflict Management Strategies in Advanced Access Control Models(2).pdf:pdf},
  issn = {15710661},
  keywords = {or-bac,potential conflict,prioritized policy,rule-bac},
  owner = {Moussa.Amrani},
  timestamp = {2013.03.12},
  url = {http://linkinghub.elsevier.com/retrieve/pii/S1571066107004562}
}

@ARTICLE{Cuppens2003,
  author = {Cuppens, F and Mi\`{e}ge, A},
  title = {{Modelling contexts in the Or-BAC model}},
  journal = {ACSAC},
  year = {2003},
  pages = {416--425},
  file = {:Users/yehia/Dropbox/Work/Bibliography/Articles/Cuppens, Mi\`{e}ge - 2003 - Modelling contexts in the Or-BAC model.pdf:pdf},
  url = {http://ieeexplore.ieee.org/xpls/abs\_all.jsp?arnumber=1254346}
}

@ARTICLE{Elrakaiby2011,
  author = {Elrakaiby, Yehia and Cuppens, Fr\'{e}d\'{e}ric and Cuppens-Boulahia,
	Nora},
  title = {{Formal enforcement and management of obligation policies}},
  journal = {Data \& Knowledge Engineering},
  year = {2011},
  pages = {1--21},
  month = sep,
  doi = {10.1016/j.datak.2011.09.001},
  file = {:Users/yehia/Dropbox/Work/Bibliography/Articles/Elrakaiby, Cuppens, Cuppens-Boulahia - 2011 - Formal enforcement and management of obligation policies.pdf:pdf},
  issn = {0169023X},
  keywords = {Conceptual modeling,Obligation monitoring,Obligation policies,Obligations,Policy
	languages,Policy management,Security},
  publisher = {Elsevier B.V.},
  url = {http://linkinghub.elsevier.com/retrieve/pii/S0169023X11001248}
}

@ARTICLE{Fabry2011a,
  author = {Fabry, Johan and Zambrano, Arturo and Gordillo, Silvia},
  title = {{Expressing aspectual interactions in design: experiences in the
	slot machine domain}},
  journal = {Model Driven Engineering Languages and Systems},
  year = {2011},
  pages = {93--107},
  file = {:Users/yehia/Dropbox/Work/Bibliography/Articles/Fabry, Zambrano, Gordillo - 2011 - Expressing Aspectual Interactions in Design Experiences in the Slot Machine Domain.pdf:pdf},
  url = {http://www.springerlink.com/index/1415350642463480.pdf}
}

@BOOK{B:Gosling-etAl,
  title = {{T}he {J}ava {L}anguage {S}pecification},
  publisher = {Addison-Wesley Longman},
  year = {2013},
  author = {{G}osling, {J}ames and {J}oy, {B}ill and {S}teele, {G}uy and {B}racha,
	{G}ilad and Buckley, Alex},
  added-at = {2008-08-17T11:10:36.000+0200},
  asin = {0321246780},
  biburl = {http://www.bibsonomy.org/bibtex/27ecc3fb9b3f3b3c322b372c99b0dfa2b/gron},
  day = {28},
  dewey = {005.133},
  ean = {9780321246783},
  interhash = {8a2d505d75cf9f9897348937116fc4e7},
  intrahash = {7ecc3fb9b3f3b3c322b372c99b0dfa2b},
  isbn = {0321246780},
  owner = {Moussa Amrani},
  timestamp = {2010.12.01}
}

@ARTICLE{Gallino2010,
  author = {Gallino, Juan Pedro Silva and Miguel, Miguel a. De and Briones, Javier
	Fern\'{a}ndez and Alonso, Alejandro},
  title = {{Model-Driven Development of a Web Service-Oriented Architecture
	and Security Policies}},
  journal = {2010 13th IEEE International Symposium on Object/Component/Service-Oriented
	Real-Time Distributed Computing},
  year = {2010},
  pages = {92--96},
  doi = {10.1109/ISORC.2010.34},
  file = {:Users/yehia/Dropbox/Work/Bibliography/Articles//Gallino et al. - 2010 - Model-Driven Development of a Web Service-Oriented Architecture and Security Policies.pdf:pdf},
  isbn = {978-1-4244-7083-9},
  keywords = {- mda,soa,ws,ws-securitypolicy},
  publisher = {Ieee},
  url = {http://ieeexplore.ieee.org/lpdocs/epic03/wrapper.htm?arnumber=5479569}
}

@ARTICLE{Gallino2012,
  author = {Gallino, J Silva and Miguel, Miguel De and {Silva Gallino}, Juan
	Pedro and de Miguel, Miguel and Briones, Javier F. and Alonso, Alejandro},
  title = {{Domain-Specific multi-modeling of security concerns in service-oriented
	architectures}},
  journal = {Services Computing (SCC), 2011 IEEE International Conference on},
  year = {2012},
  pages = {128--142},
  abstract = {As a common reference for many in-development standards and execution
	frameworks, special attention is being paid to Service-Oriented Architectures.
	SOAs modeling, however, is an area in which a consensus has not being
	achieved. Currently, standardization organizations are defining proposals
	to offer a solution to this problem. Nevertheless, until very recently,
	non-functional aspects of services have not been considered for standardization
	processes. In particular, there exists a lack of a design solution
	that permits an independent development of the functional and non-functional
	concerns of SOAs, allowing that each concern be addressed in a convenient
	manner in early stages of the development, in a way that could guarantee
	the quality of this type of systems. This paper, leveraging on previous
	work, presents an approach to integrate security-related non-functional
	aspects (such as confidentiality, integrity, and access control)
	in the development of services.},
  address = {Berlin, Heidelberg},
  doi = {10.1007/978-3-642-29834-9\_10},
  file = {:Users/yehia/Dropbox/Work/Bibliography/Articles/Gallino et al. - 2012 - Domain-Specific multi-modeling of security concerns in service-oriented architectures.pdf:pdf},
  isbn = {978-3-642-29833-2},
  publisher = {Springer-Verlag},
  series = {WS-FM'11},
  url = {http://dx.doi.org/10.1007/978-3-642-29834-9\_10 http://www.springerlink.com/index/G25U87VV8336P430.pdf}
}

@INPROCEEDINGS{Heidenreich2010a,
  author = {Heidenreich, Florian and Johannes, Jendrik and Seifert, Mirko and
	Wende, Christian},
  title = {{Closing the gap between modelling and java}},
  booktitle = {SLE'09 Proceedings of the Second international conference on Software
	Language Engineering},
  year = {2010},
  series = {SLE'09},
  pages = {374--383},
  address = {Berlin, Heidelberg},
  publisher = {Springer-Verlag},
  abstract = {Model-Driven Software Development is based on standardised models
	that are refined, transformed and eventually translated into executable
	code using code generators. However, creating plain text from well-structured
	models creates a gap that implies several drawbacks: Developers cannot
	continue to use their model-based tool machinery, relations between
	model elements and code fragments are hard to track and there is
	no easy way to rebuild models from their respective code. This paper
	presents an approach to bridge this gap for the Java programming
	language. It defines a full metamodel and text syntax specification
	for Java, from which a parser and a printer are generated. Through
	this, Java code can be handled like any other model. The implementation
	is validated with large test sets, example applications are shown,
	and future directions of research are discussed.},
  archiveprefix = {arXiv},
  arxivid = {10.1007/978-3-642-12107-4\_25},
  doi = {10.1007/978-3-642-12107-4\_25},
  eprint = {978-3-642-12107-4\_25},
  file = {:Users/yehia/Dropbox/Work/Bibliography/Articles/Heidenreich et al. - 2010 - Closing the gap between modelling and java.pdf:pdf},
  isbn = {3-642-12106-3, 978-3-642-12106-7},
  primaryclass = {10.1007},
  url = {http://www.springerlink.com/index/F50585787W605478.pdf http://dx.doi.org/10.1007/978-3-642-12107-4\_25}
}

@ARTICLE{Hoisl2012,
  author = {Hoisl, Bernhard and Sobernig, Stefan and Strembeck, Mark},
  title = {{Modeling and enforcing secure object flows in process-driven SOAs:
	an integrated model-driven approach}},
  journal = {Software \& Systems Modeling},
  year = {2012},
  month = oct,
  doi = {10.1007/s10270-012-0263-y},
  file = {:Users/yehia/Dropbox/Work/Bibliography/Articles/Hoisl, Sobernig, Strembeck - 2012 - Modeling and enforcing secure object flows in process-driven SOAs an integrated model-driven approach.pdf:pdf},
  issn = {1619-1366},
  keywords = {model-driven development,process modeling,secure object flows,security
	engineering,service-oriented architecture,soaml,uml,web services},
  url = {http://link.springer.com/article/10.1007/s10270-012-0263-y http://www.springerlink.com/index/10.1007/s10270-012-0263-y}
}

@INCOLLECTION{jurjens_towards_2001,
  author = {J\"{u}rjens, Jan},
  title = {{Towards Development of Secure Systems Using UMLsec}},
  booktitle = {Fundamental Approaches to Software Engineering},
  publisher = {Springer Berlin Heidelberg},
  year = {2001},
  editor = {Hussmann, Heinrich},
  number = {2029},
  series = {Lecture Notes in Computer Science},
  pages = {187--200},
  month = jan,
  abstract = {We show how \{UML\} (the industry standard in object-oriented modelling)
	can be used to express security requirements during system development.
	Using the extension mechanisms provided by \{UML\}, we incorporate
	standard concepts from formal methods regarding multi-level secure
	systems and security protocols. These definitions evaluate diagrams
	of various kinds and indicate possible vulnerabilities. On the theoretical
	side, this work exemplifies use of the extension mechanisms of \{UML\}
	and of a (simplified) formal semantics for it. A more practical aim
	is to enable developers (that may not be security specialists) to
	make use of established knowledge on security engineering through
	the means of a widely used notation.},
  file = {:Users/yehia/Dropbox/Work/Bibliography/Articles/J\"{u}rjens - 2001 - Towards Development of Secure Systems Using UMLsec(2).pdf:pdf;:Users/yehia/Dropbox/Work/Bibliography/Articles//J\"{u}rjens - 2001 - Towards Development of Secure Systems Using UMLsec.pdf:pdf;:Users/yehia/Dropbox/Work/Bibliography/Articles/J\"{u}rjens - 2001 - Towards Development of Secure Systems Using UMLsec.html:html},
  isbn = {978-3-540-41863-4, 978-3-540-45314-7},
  keywords = {Compilers,Interpreters,Logics and Meanings of Programs,Programming
	Languages,Software Engineering},
  url = {http://link.springer.com/chapter/10.1007/3-540-45314-8\_14}
}

@ARTICLE{Jajodia1997a,
  author = {Jajodia, S. and Samarati, P. and Subrahmanian, V.S.},
  title = {{A logical language for expressing authorizations}},
  journal = {Proceedings. 1997 IEEE Symposium on Security and Privacy},
  year = {1997},
  pages = {31--42},
  doi = {10.1109/SECPRI.1997.601312},
  file = {:Users/yehia/Dropbox/Work/Bibliography/Articles/Jajodia, Samarati, Subrahmanian - 1997 - A logical language for expressing authorizations(2).pdf:pdf},
  isbn = {0-8186-7828-3},
  publisher = {IEEE Comput. Soc. Press},
  url = {http://ieeexplore.ieee.org/lpdocs/epic03/wrapper.htm?arnumber=601312}
}

@ARTICLE{Jan2002,
  author = {Jan, J},
  title = {{UMLsec: Extending UML for secure systems development}},
  journal = {UML '02 Proceedings of the 5th International Conference on The Unified
	Modeling Language},
  year = {2002},
  pages = {412--425},
  file = {:Users/yehia/Dropbox/Work/Bibliography/Articles/Jan - 2002 - UMLsec Extending UML for secure systems development.pdf:pdf},
  publisher = {Springer},
  url = {http://www.springerlink.com/index/JY1V4KYWFMLECV0B.pdf}
}

@ARTICLE{Kagal2003,
  author = {Kagal, L. and Finin, T.},
  title = {{A policy language for a pervasive computing environment}},
  journal = {Proceedings POLICY 2003. IEEE 4th International Workshop on Policies
	for Distributed Systems and Networks},
  year = {2003},
  pages = {63--74},
  doi = {10.1109/POLICY.2003.1206958},
  file = {:Users/yehia/Dropbox/Work/Bibliography/Articles/Kagal, Finin - 2003 - A policy language for a pervasive computing environment.pdf:pdf},
  isbn = {0-7695-1933-4},
  publisher = {IEEE Comput. Soc},
  url = {http://ieeexplore.ieee.org/lpdocs/epic03/wrapper.htm?arnumber=1206958}
}

@ARTICLE{Lam2009,
  author = {Lam, P and Mitchell, J},
  title = {{A formalization of HIPAA for a medical messaging system}},
  journal = {Trust, Privacy and Security in Digital Business},
  year = {2009},
  pages = {73--85},
  file = {:Users/yehia/Dropbox/Work/Bibliography/Articles/Lam, Mitchell - 2009 - A formalization of HIPAA for a medical messaging system.pdf:pdf},
  url = {http://www.springerlink.com/index/e6281457716k0128.pdf}
}

@MISC{LAWYERS.COM,
  author = {LAWYERS.COM},
  title = {{Gramm-Leach-Bliley Act and Financial Privacy}},
  url = {http://communications-media.lawyers.com/privacy-law/Gramm-Leach-Bliley-Act-and-Financial-Privacy.html}
}

@ARTICLE{Lloyd2009,
  author = {Lloyd, John and J\"{u}rjens, Jan},
  title = {{Security analysis of a biometric authentication system using UMLsec
	and JML}},
  journal = {Model Driven Engineering Languages and Systems},
  year = {2009},
  pages = {77--91},
  file = {:Users/yehia/Dropbox/Work/Bibliography/Articles/Lloyd, J\"{u}rjens - 2009 - Security analysis of a biometric authentication system using UMLsec and JML.pdf:pdf},
  keywords = {biometric authentication,jml,security analysis,umlsec},
  url = {http://www.springerlink.com/index/d72103t1rk6792kh.pdf}
}

@ARTICLE{Lodderstedt2002,
  author = {Lodderstedt, Torsten and Basin, David},
  title = {{SecureUML : A UML-Based Modeling Language for Model-Driven Security}},
  journal = {UML '02 Proceedings of the 5th International Conference on The Unified
	Modeling Language},
  year = {2002},
  pages = {426--441},
  file = {:Users/yehia/Dropbox/Work/Bibliography/Articles/Lodderstedt, Basin, Doser - 2002 - SecureUML A UML-Based Modeling Language for Model-Driven Security.pdf:pdf}
}

@INPROCEEDINGS{May2006,
  author = {May, M.J. and Gunter, C.a. and Lee, Insup},
  title = {{Privacy APIs: Access control techniques to analyze and verify legal
	privacy policies}},
  booktitle = {19th IEEE Computer Security Foundations Workshop (CSFW'06)},
  year = {2006},
  number = {Csfw},
  pages = {13--pp},
  publisher = {Ieee},
  doi = {10.1109/CSFW.2006.24},
  file = {:Users/yehia/Dropbox/Work/Bibliography/Articles/May, Gunter, Lee - 2006 - Privacy APIs Access control techniques to analyze and verify legal privacy policies.pdf:pdf;:Users/yehia/Dropbox/Work/Bibliography/Articles//May, Gunter, Lee - 2006 - Privacy APIs Access control techniques to analyze and verify legal privacy policies.pdf:pdf},
  isbn = {0769526152},
  url = {http://ieeexplore.ieee.org/lpdocs/epic03/wrapper.htm?arnumber=1648710 http://ieeexplore.ieee.org/xpls/abs\_all.jsp?arnumber=1648710}
}

@INPROCEEDINGS{moebius_securemdd:_2009,
  author = {Moebius, N. and Stenzel, K. and Grandy, H. and Reif, W.},
  title = {{SecureMDD:} A Model-Driven Development Method for Secure Smart Card
	Applications},
  booktitle = {International Conference on Availability, Reliability and Security,
	2009. {ARES} '09},
  year = {2009},
  pages = {841--846},
  month = mar,
  abstract = {In this paper we introduce our model-driven software engineering method,
	called {SecureMDD}, which facilitates the development of security-critical
	applications that are based on cryptographic protocols. The approach
	seamlessly integrates the generation of code and formal methods.
	Starting with a platform-independent {UML} model of a system under
	development, we generate executable Java (Card) code as well as a
	formal model from the {UML} model. Subsequent to this, the formal
	model is used to verify the security of the modeled system. Our goal
	is to prove that the generated code is correct w.r.t. the generated
	formal model in terms of formal refinement. The approach is tailored
	to the domain of security-critical systems, e.g. smart card applications.},
  doi = {10.1109/ARES.2009.22},
  file = {IEEE Xplore Abstract Record:/Users/yehia/Work/zotero/storage/2REA57P9/articleDetails.html:text/html;Moebius et al. - SecureMDD A Model-Driven Development Method for S.pdf:/Users/yehia/Work/zotero/storage/6PNCA5A4/Moebius et al. - SecureMDD A Model-Driven Development Method for S.pdf:application/pdf},
  keywords = {Application software, Availability, code generation, Computer languages,
	cryptographic protocol, cryptographic protocols, Electronic mail,
	Formal verification, Java, {JavaCard}, Model-driven Development,
	Model-Driven Software Engineering, platform-independent {UML} model,
	program compilers, program verification, {SecureMDD}, Security, security-critical
	application development, smart card application security, smart cards,
	Software Engineering, Unified modeling language, Verification},
  shorttitle = {{SecureMDD}}
}

@ARTICLE{sanchez_modelsec,
  author = {Molina, Fernando and Toval, Ambrosio and S\'{a}nchez, \'{O}scar and
	Garcıa-Molina, Jes\'{u}s},
  title = {{ModelSec: A Generative Architecture for Model-Driven Security}},
  journal = {Journal of Universal Computer Science},
  year = {2009},
  volume = {15},
  pages = {2957--2980},
  number = {15},
  doi = {10.3217/jucs-015-15-2957},
  file = {:Users/yehia/Dropbox/Work/Bibliography/Articles//Molina et al. - 2009 - ModelSec A Generative Architecture for Model-Driven Security.pdf:pdf},
  keywords = {engineering,model driven,model driven security,requirements engineering,requirements
	metamodelling}
}

@ARTICLE{Mont2004a,
  author = {Mont, MC},
  title = {{Dealing with privacy obligations in enterprises}},
  journal = {ISSE 2004: securing electronic business processes:},
  year = {2004},
  pages = {28--30},
  number = {September},
  file = {:Users/yehia/Dropbox/Work/Bibliography/Articles/Mont - 2004 - Dealing with privacy obligations in enterprises.pdf:pdf},
  url = {http://books.google.com/books?hl=en\&amp;lr=\&amp;id=tMe6omP-BKcC\&amp;oi=fnd\&amp;pg=PA198\&amp;dq=Dealing+with+Privacy+Obligations+in+Enterprises\&amp;ots=XRz52iux7q\&amp;sig=MpfUKLY6Ed3pli6nG\_FHFQVeVFA}
}

@ARTICLE{Morin2010a,
  author = {Morin, Brice and Mouelhi, Tejeddine and Fleurey, Franck and {Le Traon},
	Yves and Barais, Olivier and J\'{e}z\'{e}quel, Jean-Marc},
  title = {{Security-driven model-based dynamic adaptation}},
  journal = {Proceedings of the IEEE/ACM international conference on Automated
	software engineering - ASE '10},
  year = {2010},
  pages = {205},
  number = {Ase},
  abstract = {Security is a key-challenge for software engineering, especially when
	considering access control and software evolutions. No satisfying
	solution exists for maintaining the alignment of access control policies
	with the business logic. Current implementations of access control
	rely on the separation between the policy and the application code.
	In practice, this separation is not so strict and some rules are
	hard-coded within the application, making the evolution of the policy
	difficult. We propose a new methodology for implementing security-driven
	applications. From a policy defined by a security expert, we generate
	an architectural model, reflecting the access control policy. We
	leverage the advances in the models@runtime domain to keep this model
	synchronized with the running system. When the policy is updated,
	the architectural model is updated, which in turn reconfigures the
	running system. As a proof of concept, we apply the approach to the
	development of a library management system.},
  address = {New York, New York, USA},
  doi = {10.1145/1858996.1859040},
  file = {:Users/yehia/Dropbox/Work/Bibliography/Articles/Morin et al. - 2010 - Security-driven model-based dynamic adaptation(2).pdf:pdf},
  isbn = {9781450301169},
  keywords = {access-control,adaptive system,model-driven engineering,models@runtime},
  mendeley-tags = {access-control,adaptive system,model-driven engineering,models@runtime},
  publisher = {ACM Press},
  series = {ASE '10},
  url = {http://portal.acm.org/citation.cfm?doid=1858996.1859040 http://doi.acm.org/10.1145/1858996.1859040}
}

@ARTICLE{Mouelhi2008,
  author = {Mouelhi, Tejeddine and Fleurey, Franck and Baudry, Benoit and Traon,
	Yves Le},
  title = {{A model-based framework for security policy specification, deployment
	and testing}},
  journal = {Model Driven Engineering Languages and Systems},
  year = {2008},
  pages = {537--552},
  number = {1},
  file = {:Users/yehia/Dropbox/Work/Bibliography/Articles//Mouelhi et al. - 2008 - A model-based framework for security policy specification, deployment and testing.pdf:pdf},
  keywords = {metamodeling,model-driven engineering methodology,security},
  url = {http://www.springerlink.com/index/H3L72633083U171K.pdf}
}

@ARTICLE{Ni2008,
  author = {Ni, Qun and Bertino, Elisa and Lobo, Jorge},
  title = {{An obligation model bridging access control policies and privacy
	policies}},
  journal = {Proceedings of the 13th ACM symposium on Access control models and
	technologies - SACMAT '08},
  year = {2008},
  pages = {133},
  address = {New York, New York, USA},
  doi = {10.1145/1377836.1377857},
  file = {:Users/yehia/Dropbox/Work/Bibliography/Articles/Ni, Bertino, Lobo - 2008 - An obligation model bridging access control policies and privacy policies.pdf:pdf},
  isbn = {9781605581293},
  keywords = {obligation,policy,privacy,role based access control},
  publisher = {ACM Press},
  url = {http://portal.acm.org/citation.cfm?doid=1377836.1377857}
}

@ARTICLE{Oldevik2009,
  author = {Oldevik, Jon and Menarini, Massimiliano and Kr\"{u}ger, I},
  title = {{Model Composition Contracts}},
  journal = {Model Driven Engineering Languages and Systems},
  year = {2009},
  pages = {531--545},
  file = {:Users/yehia/Dropbox/Work/Bibliography/Articles/Oldevik, Menarini, Kr\"{u}ger - 2009 - Model Composition Contracts.pdf:pdf},
  keywords = {aspect-oriented development,design by contract,model composition},
  url = {http://www.springerlink.com/index/r321r42282354350.pdf}
}

@INCOLLECTION{rao_xsb:_1997,
  author = {Rao, Prasad and Sagonas, Konstantinos and Swift, Terrance and Warren,
	David S. and Freire, Juliana},
  title = {{XSB:} A system for efficiently computing well-founded semantics},
  booktitle = {Logic Programming And Nonmonotonic Reasoning},
  publisher = {Springer Berlin Heidelberg},
  year = {1997},
  editor = {Dix, Jürgen and Furbach, Ulrich and Nerode, Anil},
  number = {1265},
  series = {Lecture Notes in Computer Science},
  pages = {430--440},
  month = jan,
  abstract = {The well-founded model provides a natural and robust semantics for
	logic programs with negative literals in rule bodies. We implemented
	the well-founded semantics in the {SLG-WAM} of {XSB} [19]. Performance
	results indicate that the overhead of delay and simplification to
	Prolog — or tabled — evaluations is minimal. To compute the well-founded
	semantics, the {SLG-WAM} adds to an efficient tabling engine for
	definite programs three operations — negative loop detection, delay
	and simplification — which serve to detect, to break and to resolve
	cycles through negation that might arise in evaluating normal programs.
	{XSB} is a full Prolog system that closely approximates the {ISO}
	standard; additionally, it supports a tight integration of tabled
	predicates with nontabled predicates.},
  copyright = {©1997 Springer-Verlag},
  file = {Full Text PDF:/Users/yehia/Work/zotero/storage/37MRBTU2/Rao et al. - 1997 - XSB A system for efficiently computing well-found.pdf:application/pdf;Snapshot:/Users/yehia/Work/zotero/storage/8ZT2KNBW/10.html:text/html},
  isbn = {978-3-540-63255-9, 978-3-540-69249-2},
  keywords = {Artificial Intelligence (incl. Robotics), Mathematical Logic and Formal
	Languages, Programming Techniques},
  shorttitle = {{XSB}},
  url = {http://link.springer.com/chapter/10.1007/3-540-63255-7_33},
  urldate = {2013-03-15}
}

@ARTICLE{Reggio2011,
  author = {Reggio, Gianna and Ricca, Filippo and Scanniello, Giuseppe},
  title = {{A precise style for business process modelling: results from two
	controlled experiments}},
  journal = {Model Driven Engineering Languages and Systems},
  year = {2011},
  pages = {138--152},
  file = {:Users/yehia/Dropbox/Work/Bibliography/Articles//Reggio, Ricca, Scanniello - 2011 - A precise style for business process modelling results from two controlled experiments.pdf:pdf},
  keywords = {business process modelling,con-,precise and ultra-light styles,trolled
	experiment,uml activity diagrams},
  url = {http://www.springerlink.com/index/A883MP7433944742.pdf}
}

@ARTICLE{Park2004,
  author = {Sandhu, Ravi and Park, J.},
  title = {{The UCON ABC usage control model}},
  journal = {ACM Transactions on Information and System Security (TISSEC)},
  year = {2004},
  volume = {7},
  pages = {128--174},
  number = {1},
  file = {:Users/yehia/Dropbox/Work/Bibliography/Articles//Sandhu, Park - 2004 - The UCON ABC usage control model.pdf:pdf;:Users/yehia/Dropbox/Work/Bibliography/Articles//Sandhu, Park - 2004 - The UCON ABC usage control model.pdf:pdf},
  publisher = {ACM},
  url = {http://dl.acm.org/citation.cfm?id=984339}
}

@ARTICLE{TheEuropeanParlimentandtheCouncil2002,
  author = {{The European Parliment and the Council}},
  title = {{Directive 2002/58/EC of the European Parliament and of the Council
	of 12 July 2002 concerning the processing of personal data and the
	protection of privacy in the electronic commu- nications sector (Directive
	on privacy and electronic communications)}},
  journal = {Communications},
  year = {2002},
  file = {:Users/yehia/Dropbox/Work/Bibliography/Articles/The European Parliment and the Council - 2002 - Directive 200258EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic commu- nications sector (Direc.pdf:pdf}
}

@ARTICLE{TheEuropeanParlimentandtheCouncil1995,
  author = {{The European Parliment and the Council}},
  title = {{Directive 1995/46/EC of the european parliment and the council of
	24 october 1995 on the protection of individuals with regard to the
	processing of personal data and on the free movement of such data}},
  journal = {Official Journal of the European Communities},
  year = {1995},
  file = {:Users/yehia/Dropbox/Work/Bibliography/Articles/The European Parliment and the Council - 1995 - Directive 199546EC of the european parliment and the council of 24 october 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data.pdf:pdf},
  url = {http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:31995L0046:en:HTML}
}

@ARTICLE{Traon2010,
  author = {Traon, Yves Le and Bretagne, Universit\'{e} De and Baudry, Benoit
	and Inria, Irisa and Mouelhi, Tejeddine and Fleurey, Franck},
  title = {{Language-specific vs. language-independent approaches: embedding
	semantics on a metamodel for testing and verifying access control
	policies}},
  year = {2010},
  abstract = {in this paper, we study an issue related to the abstraction level
	of a meta-model through the example of a model-driven approach for
	specifying, deploying and testing security policies in Java applications.
	The issue we focus on is the balance between a 'generic' meta-model
	and the semantics we want to attach to it, which has to be precise
	enough. The goal of the original work was to present a full MDE process
	to check the consistency of a security policy and generate qualification
	criteria for the test cases testing the security mechanisms in the
	final code. The most original idea is that security policy is specified
	independently of the underlying access control language (OrBAC, RBAC,
	DAC or MAC). It is based on a generic security meta-model which can
	be used for early consistency checks in the security policy. We qualify
	the test cases that validate the security policy in the application
	with a fault injection technique, mutation applied to access control
	policies. In the empirical results on 3 case studies, we explore
	the advantages and limitations of the mutation operators and verification
	checks whose semantics is defined on the meta-model. The overall
	question we address is not the feasibility of the approach as shown
	in our previous work but the quality of a metamodel for test and
	verification purpose.},
  file = {:Users/yehia/Dropbox/Work/Bibliography/Articles/Traon et al. - 2010 - Language-specific vs. language-independent approaches embedding semantics on a metamodel for testing and verifying access control policies.pdf:pdf;:Users/yehia/Dropbox/Work/Bibliography/Articles/Traon et al. - 2010 - Language-specific vs. language-independent approaches embedding semantics on a metamodel for testing and verifying access control policies.html:html},
  keywords = {-metamodeling,mde methodology,security},
  shorttitle = {Language-specific vs. language-independent approac},
  url = {http://hal.archives-ouvertes.fr/hal-00498383 http://hal.archives-ouvertes.fr/docs/00/49/83/83/PDF/LeTraon-QuoMBaT.pdf http://hal.inria.fr/hal-00498383/}
}

@MISC{USCongress1999a,
  author = {{US Congress}},
  title = {{The Gramm-Leach-Bliley Act}},
  year = {1999},
  booktitle = {Berkeley Tech. LJ},
  file = {:Users/yehia/Dropbox/Work/Bibliography/Articles/US Congress - 1999 - The Gramm-Leach-Bliley Act.pdf:pdf},
  pages = {1--145},
  url = {http://heinonlinebackup.com/hol-cgi-bin/get\_pdf.cgi?handle=hein.journals/berktech17\&amp;section=35}
}

@MISC{USCongress1999,
  author = {{US Congress}},
  title = {{Health Insurance Portability and Accountability Act of 1996}},
  year = {1996},
  booktitle = {Public Health},
  file = {:Users/yehia/Dropbox/Work/Bibliography/Articles/US Congress - 1996 - Health Insurance Portability and Accountability Act of 1996.pdf:pdf},
  pages = {1--169},
  url = {http://www.gpo.gov/fdsys/pkg/PLAW-106publ102/content-detail.html}
}

@ARTICLE{VanGelder1991a,
  author = {{Van Gelder}, Allen and Ross, Kenneth A. and Schlipf, John S.},
  title = {{The well-founded semantics for general logic programs}},
  journal = {Journal of the ACM},
  year = {1991},
  volume = {38},
  pages = {619--649},
  number = {3},
  month = jul,
  doi = {10.1145/116825.116838},
  file = {:Users/yehia/Dropbox/Work/Bibliography/Articles/Van Gelder, Ross, Schlipf - 1991 - The well-founded semantics for general logic programs.pdf:pdf},
  issn = {00045411},
  owner = {Moussa.Amrani},
  timestamp = {2013.03.12},
  url = {http://portal.acm.org/citation.cfm?doid=116825.116838}
}

@ARTICLE{Win2002a,
  author = {Win, Bart De and Piessens, Frank and Joosen, Wouter and Verhanneman,
	Tine},
  title = {{On the importance of the separation-of-concerns principle in secure
	software engineering}},
  journal = {On the importance of the separation-of-concerns principle in secure
	software engineering},
  year = {2002},
  pages = {1--10},
  file = {:Users/yehia/Dropbox/Work/Bibliography/Articles/Win et al. - 2002 - On the importance of the separation-of-concerns principle in secure software engineering.pdf:pdf},
  url = {http://www.acsac.org/waepssd/papers/02-piessens.pdf}
}

@ARTICLE{Xu2012,
  author = {Xu, Dianxiang and Thomas, Lijo and Kent, Michael and Mouelhi, Tejeddine
	and {Le Traon}, Yves},
  title = {{A model-based approach to automated testing of access control policies}},
  journal = {Proceedings of the 17th ACM symposium on Access Control Models and
	Technologies - SACMAT '12},
  year = {2012},
  pages = {209},
  address = {New York, New York, USA},
  doi = {10.1145/2295136.2295173},
  file = {:Users/yehia/Dropbox/Work/Bibliography/Articles/Xu et al. - 2012 - A model-based approach to automated testing of access control policies(2).pdf:pdf},
  isbn = {9781450312950},
  keywords = {access control,model-based testing,petri nets,software testing},
  publisher = {ACM Press},
  url = {http://dl.acm.org/citation.cfm?doid=2295136.2295173}
}

